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Amendmerrts to The Claims: 

This listing of cidims will replace all prior versions, and listings, of cialms In the 
application: 
Listing of Claims: 

1 (Original) A method for increasing security of a software program by obfuscation 
of program execution flow, wherein the software program is executed on a computer 
system that includes a user-level protected mode and a kernel-level unprotected mode, 
the method comprising the steps of: 

(a) identifying critical code segments to be hidden in the software program; 

(b) executing non-critical portions of the software program in the user-level 
protected mode; and 

(c) executing the critical code segments within respective exception handlers, 
thereby hiding execution of the critical code segments from a debugger 
program. 

2 (Original) The method of claim 1 wherein step (a) further includes the step of 

(i) inserting an exception set-up handler into the software program 
that sets-up the exception handlers so that the exception handlers 
will be invoked during program execution. 

3 (Original) The method of claim 2 wherein step (a) further includes the step: 
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(ii) inserting an in-line cxKie segment in the softvvare program, wherein the In- 
line code segment sets up and executes the exception set-up handler during program 
execution. 

4 (Original) The method of claim 1 wherein step (a) further includes the step of: 

(i) inserting a kernel level driver in the software program that sets-up 
the exception handlers so that the exception handlers v^ll t>e 
invoked during program execution. 

6 (Original) The method of claim 4 wherein step (a) further includes the step of: 

(ii) inserting an in-line code segment in the software program, wherein 
the in-line code segment invokes the kernel-level driver, thus 
causing the exception handlers to be invoked during program 
execution. 

6 (Original) The method of claim 3 further including the step of: using the set-up 
handler to initiate a setHjp of debug registers, such that the critical code segments in 
the exception handlers are executed at appropriate times during the program 
execution. 

7 (Original) The method of claim 6 further including the step of: executing the In- 
line code segment prior to a point in the program flow where any of the critical coda 
segments was removed for placement into the exception handlers. 

4 
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8 (Original) The method of claim 7 further including the step of: using the in-line 
code segment to install the exception set-up handler on an exception handler linked list 
for a current thread, such that when an exception occurs, the operating system hands 
control to the exception set-up handler for execution. 

9 (Original) The method of claim 8 further including the step of: removing the 
exception set-up handler from the linked list after execution. 

10 (Onginal) The method of claim 8 further including the step of: inserting each of 
the exception handlers into the linked list. 

1 1 (Original) The method of claim 10 further including the step of: when an 
exception is raised to the operating system^ handing control down the linked list until 
one of the exception handlers determines that the exception is one that the exception 
handler is designed to handle. 

12 (Original) The method of claim 1 1 further including the step of: if the exception 
is one for which the current exception handler was designed to handle, executing the 
critical code segment included in the current exception handler. 



5 
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13 (Original) The method of claim 12 further including the step of: if the exception 
Is one for which the exception setnip handler was designed to handle, setting a return 
address for the exception set-up handler when the exception processing completes. 

1 4 (Original) The method of claim Errorl Reference source not found, further 
including the step of: modifying debug registers during execution of the exception 
handlers such that any number of exception handlers may be daisy chained. 

15 (Original) A method for increasing security of a software program by obfuscation 
of the software program execution flow, the method comprising the steps of: 

(a) partitioning the software program into code segments, each code segment 
having a particular location within the program execution flow; 

(b) identifying one or more critical code segments; 

(c) encapsulating the critical code segments in respective exception 
handlers; and 

(d) during software program execution, executing the code segments and the 
exception handlers containing the critical code segments in their 
respective relative location within the program execution flow, 

16 (Original) A method for obfuscation of computer program execution flow to 
increase computer program security, the method comprising the steps of: 

(a) breaking the computer code into a plurality of code segments, and 
identifying critical code segments to be obfuscated; 

6 
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(b) embedding each of one or more critical code segments within 
respective first exception handlers; 

(c) providing an exception set-up handler to set up operation of the 
first exception handlers; 

(d) embedding an in-line code segment within a first one of the 
remaining plurality of code segments for setting up and invoking 
the exception set-up handler. 

17 (Original) The method of claim 16 wherein step (c) further includes the step of: 
using the set-up handler to initiate a set-up of debug registers, such that the critical 
oode segments in the exception handlers are executed at appropriate times during the 
program execution. 

18 (Original) The method of claim 16 wherein step (d) further includes the step of: 
executing the in-line code segment prior to a point in the program flow where any of the 
critical code segments was removed for placement into the exception handlers. 

19 (Original) The method of claim 18 further Including the step of: using the irvline 
code segment to install the exception set-up handler on an exception handler linked list 
for a current thread, such that when an exception occurs, the operating system hands 
control to the exception set-up handler for e»cutlon. 



7 
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20 (Original) The method of daim 1 9 further including the step of: removing the 
exception set-up handler from the linked list after execution. 

21 (Original) The method of claim 1 7 wherein step (b) further includes the step of. 
inserting each of the exception harKilers into the linked list. 

22 (Original) The method of daim 21 further including the step of: when an 
exception is raised to the operating system, handing control down the linked list until 
one of the mcepUon harnjlers determines that the exception is one that the exception 
handler is designed to handle. 

23 (Original) The method of daim 22 further including the step of: if the exception 
is one for which the cun^ent exception handler was designed to handle, executing the 
critical code segment included in the current exception handler. 

24 (Original) The method of daim 23 further including the step of: If the exception 
is one for which the exception set-up handler was designed to handle, setting a return 
address for the exception set-up handler when the exception processing completes. 

25 (Currently Amended) The method of claim 24 further in dud i n g includina the step 
of: modifying debug registers during -execution of the exception handlers such that any 
number of exception handlers may t>e daisy chained. 
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26 (Origrnal) The method of claim 1 6 wherein step (b) further includes the step of 
providing entry code for the first exception handlers to determine a nature of the 
exception. 

27 (Orioinal) The method of claim 26 further including the step of handling the 
exception if the nature of the exception is applicable to the first exception handler, 
otherwise handing exception processing to the next available exception handler. 

28 (Original) The method of claim 1 6 further including the step of olrfuscating the 
critical code segments to prevent reverse engineering. 

29 (Original) The method of claim 16 further including the step of obfuscating the 
critical code segments to hide anti-piracy algorithms. 

30 (Original) The method of claim 16 further Including the step of providing code for 
the first exception handlers to modify a return address to be used after completion of 
the exception processing 

31. (Original) The method of claim 30 further including the step of rearranging non- 
embedded code segments out of normal execution order, and setting exception 
addresses and retunn addresses to ensure proper program sequencing to further 
ot>fuscate the program execution flow. 

32 (Original) The method of claim 16 further including the step of including code 
within the first exception handlers to modify the exception conditions to support future 
exceptions. 



9 



PA6E12fi6>RCVDAT3l8l20ll68:33:59ra[Eastema^ 



Mar 09 06 05i41a St;rat;egio Patent Group 6S06S1S077 p. 13 

Attorney Docket: 2319P 

33 (Original) The method of claim 32, further including the step of including a 
plurality of code segments within the first exception handler. 

34 (Original) The method of claim 33, further Including the step of selecting which of 
a plurality of code segments within the first exception handler should k>e executed 
based on the exception information. 

36 (Original) The memod of daim 32, further including the step of embedding one 
or more first exception harKflers into other first exception handlers to further obfuscate 
the program execution flow. 

36 (Original) A method for obfuscation of computer program execution flow to 
increase computer program security, the method comprising the steps of: 

(a) partitioning the program into a plurality of non-crltical code segments and 
at least one critical code segment; 

(b) obfuscating the critical code segments by embedding each of one of the 
critical code segments within a respective exception handler; 

(c) providing a driver to set up operation of the first exception handlers; and 

(d) embedding an in-line code segment within a first non-critical code 
segment for invoking the driver when the program is executed. 



10 
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37 (Original) The method of claim 36 wherein step (c) further including the step of: 
using the driver to initiate a set-up of debug registers, such that the critical code 
segments in the exception handlers are executed at appropriate times during the 
program execution. 

38 (Original) The method of Claim 37 further including the step of: executing the 
driver prior to a point In the program flow where any of the critical code segments was 
removed for placement into the exception handlers. 

39 (Original) The method of claim 37 wherein step (b) further includes the step of: 
inserting each of the exception handlers Into the linked list 

40 (Original) The method of claim 39 further including the step of: when the 
exception is raised to the operating system, handing control down the linked list until 
one of the exception handlers detennines that the exception is one that the exception 
handler is designed to handle. 

41 (Original) The method of claim 40 further including the step of: if the exception 
is one for which the cunrent exception handler was designed to handle, executing the 
critical code segment Included in the current exception handler. 



11 
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42 (Original) The method of claim 41 further including the step oft if the exception 
is one for which the exception set-up handler was designed to handle, setting a return 
address for the exception set-up handler when the exception processing completes. 

43 (Original) The method of claim 42 further including the step of: modifying debug 
registers during execution of the exception handlers such that any number of exception 
handlers may be daisy chained. 

44 (Original) The method of claim 36 wherein step (b) further includes the step of 
providing entry code for the first exception handlers to determine a nature of the 
exception. 

45 (Original) The method of claim 44, further comprising the step of handling the 
exception if the nature of the exception is applicable to the first exception handler, 
otherwise handing exception processing to the next available exception handler. 

46 (Original) The method of claim 36, further comprising the step of selecting from 
the plurality of code segments the segments to obfuscate v\rtthln the first exception 
handlers based on the value of obfuscating the algorithms within the segment. 

47 (Original) The method of claim 42, further comprising the step of providing code 
for the first exception handlers to modify the return address to be used after completion 
of the exception processing 
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48 (Original) The method of daim 47, further comprising the step of rearranging the 
remaining non-embedded code segments out of normal execution order, and setting 
exception addresses and return addresses to ensure proper program sequencing to 
further obfuscate the program execution flow. 

49 (Original) The method of claim 42, further comprising the step of including code 
within the first exception handlers to modify the exception conditions to support future 
exceptions. 

50 (Original) The method of claim 49, further comprising the step of including a 
plurality of code segments within the first exception handler. 

51 (Original) The mettiod of claim 50, fUrttier comprising the step of selecting which 
of a plurality of code segments within the first exception handler should be executed 
based on the Bxception information 

52 (Original) The method of claim 36, further comprising the step of including 
additional, unrelated driver code within the driver to further obfuscate the operation of 
the program execution flow. 

53 (Original) The method of claim 42, further comprising the step of setting up 
exceptions to occur within one or more first exception handlers, to be handled by other 
first exception handlers, to further obfuscate the program execution flow. 

54 (Original) The method of claim 53, further comprising the step of repeating the 
embedded exceptions within exception handlers such that the required exception 
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processing occurs at a plurality of exception processing levels, to further obfuscate the 
program execution flow. 

55 (Original) A computer-readable medium containing a software program that is to 
be executed on a computer system that Includes a user-teval protected mode and a 
kernel-level unprotected mode, wherein the software program contains critical code 
segments to k>e obfuscated during program execution flow to increase security of the 
software program, the software program comprising instnidions for: 

(a) executing non-critical portions of the software program in the user-level 
protected mode; and 

(b) executing the critical code segments within respective exception handlers, 
thereby hiding execution of the critical code segments from a debugger 
program. 

56 (Original) 1Tie computer-readable medium of claim 55 wherein instruction (a) 
further includes the instruction of 

(i) invoking an exception set-up handler within the software program 
that sets-up the exception handlers so that the exception handlers 
will be Invoked during program execution. 

57 (Original) The computer-readable medium of claim 56 wherein instruction (a) 
further includes the instruction: 
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(ii) inserting an in-line code segment in the software program, wherein the in- 
line code segment sets up and executes the exception set-up handler during program 
execution. 



58 (Original) The computer-readable medium of claim 65 wherein instruction (a) 
further includes the instmction of: 

(i) invoking a kernel level driver In the software program that sats-up 
the exception handlers so that the exception handlers will be 
invoked during program execution. 



59 (Original) The computer-readable medium of claim 58 wherein instruction (a) 

further includes ttie Instruction of: 

(ii) invoking an in-line code segment in the software program, wherein 
the ih-line code segment invokes the kernel-level driver, thus 
causing the exception handlers to be invoked during program 
execution. 



60 (Original) The computer-readable medium of claim 57 further including the 
instnjctlon of. causing the set-up handler to set-up debug registers, such that the 
critical code segments in the exception handlers are executed at appropriate times 
during the program execution. 
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61 (Original) The computer-readable medium of claim 60 further including the 
instruction of. executing the irHlne code segment prior to a poirt in the program flow 
where any of the critical code segments was removed for placement into the exception 
handlers. 

62 (Original) The computeweadable medium of claim 61 further including the 
instruction of: causing the in-line code segment to install the exception set-up handler 
on an exception handier linked list for a cun^ent thread, such that when an exception 
occurs, the operating system hands control to the exception set-up handler for 
execution. 

63 (Original) The computer-readable medium of claim 62 further including the 
instruction of: removing the exception set-up handler from the linked list after execution. 

64 (Original) The computer-readable medium of claim 62 further including the 
instruction of: inserting each of the exception handlers into the linked list, 

65 (Original) The computer-readable medium of claim 64 further including the 
instruction of: when the exception is raised to the operating system, and control is 
passed down the linked list to each of the exception handlers, determining that the 
exception is one that a current exception handler Is desi^^ed to handle. 
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66 (Original) The computer-readable medium of claim 65 ftjrther including the 
instaiction of: if the exception is one for which the current exception handler was 
designed to handle, executing the critical code segment irKluded in the current 
exception handler. 

67 (Original) The computer-readable medium of claim 66 further including the 
instruction of: if the exception is one for which the exception &et-up handler was 
designed to handle, setting a debug register with a return address for the exception 
set-up handler when the exception processing completes. 

68 (Original) The computer-readable medium of claim 67 further including the 
instruction of: modifying debug registers during execution of the exception handlers 
such that any number of exception handlers may be daisy chained. 

69 (Original) A system for obfuscation of program execution flow, comprising: 

a computer system including a processor, memory, an operating system that 
provides kernel-level and user-level execution modes, and debug resources to support 
the generation and processing of exceptions at specified addresses; and 
an obfuscated program comprising, 

a plurality of critical code segments encapsulated within respective 
exception handlers, and 

a setHjp handler for setting up the debug registers such that when 
the compute system exectites the program, the exception handlers 

17 
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containing the critical code segments are executed in the kernel level 
mode. 
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